1 files changed, 19 insertions, 0 deletions

diff --git a/ymir.nix b/ymir.nix
index fbe45e03..dd2c35c7 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -959,4 +959,23 @@ in rec {
   systemd.status-mail = {
     onFailure = [ "nixos-upgrade" "postfix" "dovecot2" "prosody" "opendkim" "nsd" "unbound" "tinc.yggdrasil" "postsrsd" ];
   };
+
+  services.vsftpd = {
+    enable = true;
+    forceLocalLoginSSL = true;
+    forceLocalDataSSL = true;
+    localUsers = true;
+    writeEnable = true;
+    chrootLocalUser = true;
+    rsaKeyFile = "/var/lib/acme/yggdrasil.li/key.pem";
+    rsaCertFile = "/var/lib/acme/yggdrasil.li/fullchain.pem";
+    extraConfig = ''
+      pam_service_name=vsftpd
+    '';
+  };
+
+  security.pam.services."vsftpd".text = ''
+    auth requisite  pam_succeed_if.so user ingroup ftp
+    auth required   pam_unix.so audit
+  '';
 }